Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
136s -
max time network
153s -
platform
windows10-1703_x64 -
resource
win10-20230703-en -
resource tags
arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system -
submitted
28/08/2023, 17:09
Static task
static1
Behavioral task
behavioral1
Sample
1da124aeca38631bd64fb2fb4e3c011bf9496c482654f29e81aeb150f3173236.exe
Resource
win10-20230703-en
General
-
Target
1da124aeca38631bd64fb2fb4e3c011bf9496c482654f29e81aeb150f3173236.exe
-
Size
1.4MB
-
MD5
0ff650bb30c730e27ac477a02f725cb0
-
SHA1
c749f6f44725f2f4905bef05a3f79096327b4e5a
-
SHA256
1da124aeca38631bd64fb2fb4e3c011bf9496c482654f29e81aeb150f3173236
-
SHA512
e8dd1c1034f28bfa850b2511d93b129d79a3c7454b0b7c5f648b11cb7c9a61edb2eeaf789327be801f1b72791bd3bb035c83faaa9e4f78dad277df716a406261
-
SSDEEP
24576:QyM8RUv0CPIUYl+YnKElET+wPXUdiJKxVz01fO/RF+6u5De08c3yYuh:XM9cCPIUOnKElETp0iJjMF+/i053Ru
Malware Config
Extracted
amadey
3.87
77.91.68.18/nice/index.php
Extracted
redline
stas
77.91.124.82:19071
-
auth_value
db6d96c4eade05afc28c31d9ad73a73c
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 9 IoCs
pid Process 4956 y4929848.exe 2844 y4435771.exe 1180 y3174002.exe 2088 l4118326.exe 2080 saves.exe 1176 m8834172.exe 4400 n6684726.exe 2576 saves.exe 4788 saves.exe -
Loads dropped DLL 1 IoCs
pid Process 1144 rundll32.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" y4435771.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" y3174002.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 1da124aeca38631bd64fb2fb4e3c011bf9496c482654f29e81aeb150f3173236.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" y4929848.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2028 schtasks.exe -
Suspicious use of WriteProcessMemory 48 IoCs
description pid Process procid_target PID 3116 wrote to memory of 4956 3116 1da124aeca38631bd64fb2fb4e3c011bf9496c482654f29e81aeb150f3173236.exe 70 PID 3116 wrote to memory of 4956 3116 1da124aeca38631bd64fb2fb4e3c011bf9496c482654f29e81aeb150f3173236.exe 70 PID 3116 wrote to memory of 4956 3116 1da124aeca38631bd64fb2fb4e3c011bf9496c482654f29e81aeb150f3173236.exe 70 PID 4956 wrote to memory of 2844 4956 y4929848.exe 71 PID 4956 wrote to memory of 2844 4956 y4929848.exe 71 PID 4956 wrote to memory of 2844 4956 y4929848.exe 71 PID 2844 wrote to memory of 1180 2844 y4435771.exe 72 PID 2844 wrote to memory of 1180 2844 y4435771.exe 72 PID 2844 wrote to memory of 1180 2844 y4435771.exe 72 PID 1180 wrote to memory of 2088 1180 y3174002.exe 73 PID 1180 wrote to memory of 2088 1180 y3174002.exe 73 PID 1180 wrote to memory of 2088 1180 y3174002.exe 73 PID 2088 wrote to memory of 2080 2088 l4118326.exe 74 PID 2088 wrote to memory of 2080 2088 l4118326.exe 74 PID 2088 wrote to memory of 2080 2088 l4118326.exe 74 PID 1180 wrote to memory of 1176 1180 y3174002.exe 75 PID 1180 wrote to memory of 1176 1180 y3174002.exe 75 PID 1180 wrote to memory of 1176 1180 y3174002.exe 75 PID 2080 wrote to memory of 2028 2080 saves.exe 76 PID 2080 wrote to memory of 2028 2080 saves.exe 76 PID 2080 wrote to memory of 2028 2080 saves.exe 76 PID 2080 wrote to memory of 2452 2080 saves.exe 78 PID 2080 wrote to memory of 2452 2080 saves.exe 78 PID 2080 wrote to memory of 2452 2080 saves.exe 78 PID 2452 wrote to memory of 4976 2452 cmd.exe 80 PID 2452 wrote to memory of 4976 2452 cmd.exe 80 PID 2452 wrote to memory of 4976 2452 cmd.exe 80 PID 2452 wrote to memory of 1060 2452 cmd.exe 81 PID 2452 wrote to memory of 1060 2452 cmd.exe 81 PID 2452 wrote to memory of 1060 2452 cmd.exe 81 PID 2452 wrote to memory of 2596 2452 cmd.exe 82 PID 2452 wrote to memory of 2596 2452 cmd.exe 82 PID 2452 wrote to memory of 2596 2452 cmd.exe 82 PID 2452 wrote to memory of 4468 2452 cmd.exe 83 PID 2452 wrote to memory of 4468 2452 cmd.exe 83 PID 2452 wrote to memory of 4468 2452 cmd.exe 83 PID 2452 wrote to memory of 216 2452 cmd.exe 85 PID 2452 wrote to memory of 216 2452 cmd.exe 85 PID 2452 wrote to memory of 216 2452 cmd.exe 85 PID 2844 wrote to memory of 4400 2844 y4435771.exe 84 PID 2844 wrote to memory of 4400 2844 y4435771.exe 84 PID 2844 wrote to memory of 4400 2844 y4435771.exe 84 PID 2452 wrote to memory of 3400 2452 cmd.exe 86 PID 2452 wrote to memory of 3400 2452 cmd.exe 86 PID 2452 wrote to memory of 3400 2452 cmd.exe 86 PID 2080 wrote to memory of 1144 2080 saves.exe 88 PID 2080 wrote to memory of 1144 2080 saves.exe 88 PID 2080 wrote to memory of 1144 2080 saves.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\1da124aeca38631bd64fb2fb4e3c011bf9496c482654f29e81aeb150f3173236.exe"C:\Users\Admin\AppData\Local\Temp\1da124aeca38631bd64fb2fb4e3c011bf9496c482654f29e81aeb150f3173236.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y4929848.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y4929848.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y4435771.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y4435771.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\y3174002.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\y3174002.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\l4118326.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\l4118326.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe"C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN saves.exe /TR "C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe" /F7⤵
- Creates scheduled task(s)
PID:2028
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "saves.exe" /P "Admin:N"&&CACLS "saves.exe" /P "Admin:R" /E&&echo Y|CACLS "..\b40d11255d" /P "Admin:N"&&CACLS "..\b40d11255d" /P "Admin:R" /E&&Exit7⤵
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"8⤵PID:4976
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "saves.exe" /P "Admin:N"8⤵PID:1060
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "saves.exe" /P "Admin:R" /E8⤵PID:2596
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"8⤵PID:4468
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\b40d11255d" /P "Admin:N"8⤵PID:216
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\b40d11255d" /P "Admin:R" /E8⤵PID:3400
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main7⤵
- Loads dropped DLL
PID:1144
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\m8834172.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\m8834172.exe5⤵
- Executes dropped EXE
PID:1176
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\n6684726.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\n6684726.exe4⤵
- Executes dropped EXE
PID:4400
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exeC:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe1⤵
- Executes dropped EXE
PID:2576
-
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exeC:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe1⤵
- Executes dropped EXE
PID:4788
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD54642ab09cf7fbdfe60feaa10c7eec886
SHA18703f32040cece76721a67078c276505b1e4eede
SHA2569d16655d78093c456041dea0a08daa7e9125435e96fde66c376adde94ce42af1
SHA51205e5fa9042d6df02c977425b8acef85296a3973e756f95cc0922561911c23dd47f73244969bc6ac0e9ee3f69c81ddc0e3324c75bc7e5299344cc02bfc6e2461c
-
Filesize
1.3MB
MD54642ab09cf7fbdfe60feaa10c7eec886
SHA18703f32040cece76721a67078c276505b1e4eede
SHA2569d16655d78093c456041dea0a08daa7e9125435e96fde66c376adde94ce42af1
SHA51205e5fa9042d6df02c977425b8acef85296a3973e756f95cc0922561911c23dd47f73244969bc6ac0e9ee3f69c81ddc0e3324c75bc7e5299344cc02bfc6e2461c
-
Filesize
475KB
MD5a9e382aa9b0caf45273812d10f8b5b20
SHA1bab4298edac53909107d476e24afa28281c36713
SHA2566be9d079cf1fc0dc3627e4e8527b6b6dd621d233b8c4a54718fd427ce49a4b6c
SHA512cf3ff22ce59369c5cc03867fbf7edda5ba3f43828b1c6a47cb01951382563737aeddbd98837811ccc74d7e69965d7290d270022950d15eceea25454cd4e60549
-
Filesize
475KB
MD5a9e382aa9b0caf45273812d10f8b5b20
SHA1bab4298edac53909107d476e24afa28281c36713
SHA2566be9d079cf1fc0dc3627e4e8527b6b6dd621d233b8c4a54718fd427ce49a4b6c
SHA512cf3ff22ce59369c5cc03867fbf7edda5ba3f43828b1c6a47cb01951382563737aeddbd98837811ccc74d7e69965d7290d270022950d15eceea25454cd4e60549
-
Filesize
174KB
MD5ccd4350d31f8788aa1affc94f84a1fe1
SHA124bcb2544beffd0f54a4e8e058ad810aabef2ad0
SHA25616e749fc4239b60595238d39d8a4e9cb832b055ea5a6a8be5ed0737ee8216121
SHA5128aaf767f12469e0cd926be0c21cae652a4b5448c10bbdb3b8d6665d51f7c793187860c35ec76024c60b02251421e3d5ad4b545c1df0e7f065385760da5032522
-
Filesize
174KB
MD5ccd4350d31f8788aa1affc94f84a1fe1
SHA124bcb2544beffd0f54a4e8e058ad810aabef2ad0
SHA25616e749fc4239b60595238d39d8a4e9cb832b055ea5a6a8be5ed0737ee8216121
SHA5128aaf767f12469e0cd926be0c21cae652a4b5448c10bbdb3b8d6665d51f7c793187860c35ec76024c60b02251421e3d5ad4b545c1df0e7f065385760da5032522
-
Filesize
319KB
MD5376355d2b2ab967c1c9cba4ba49d7a87
SHA15e7b6d8dec24c881080719633f738f723e11c6a2
SHA25659b6dc2dac101d277630a50b2d4eb745979c1531b7173b3bbd3a8f9defc772d9
SHA51275405625d1553d01c7f9f8d1b1218f37f6b83b5eaa00d850c04f02c225a9bb99cfbf313c1559c97bf97c08f6f4245199af80413d81a4c76ea2e429c71e0654f1
-
Filesize
319KB
MD5376355d2b2ab967c1c9cba4ba49d7a87
SHA15e7b6d8dec24c881080719633f738f723e11c6a2
SHA25659b6dc2dac101d277630a50b2d4eb745979c1531b7173b3bbd3a8f9defc772d9
SHA51275405625d1553d01c7f9f8d1b1218f37f6b83b5eaa00d850c04f02c225a9bb99cfbf313c1559c97bf97c08f6f4245199af80413d81a4c76ea2e429c71e0654f1
-
Filesize
324KB
MD52f03c86a61ca5d85e08b6ca71b9ff42f
SHA147eca57f9899382e8806257baee446b7b5e2264d
SHA2563181bf399ec6fc0a9f8d816dfba604c28411a2c24d4b5fe63b79fc4c6fcd1241
SHA512963314d4e8f25489303ec54f011a63c229898bee9e36549612ae0109d6744ee43e679b5746abebc9dd78ae7a3c175393602d7dd7953fa56fa0f742cacdd7c3bf
-
Filesize
324KB
MD52f03c86a61ca5d85e08b6ca71b9ff42f
SHA147eca57f9899382e8806257baee446b7b5e2264d
SHA2563181bf399ec6fc0a9f8d816dfba604c28411a2c24d4b5fe63b79fc4c6fcd1241
SHA512963314d4e8f25489303ec54f011a63c229898bee9e36549612ae0109d6744ee43e679b5746abebc9dd78ae7a3c175393602d7dd7953fa56fa0f742cacdd7c3bf
-
Filesize
140KB
MD59da8bd3422fb22f0fc285818d8c3f15c
SHA1169c8ad53720308177bd2ab23c80b9c5bb486810
SHA25629a8d6f983254091d51ae0c5828b267683f0b3618ea16dfc7765be3a4f9bb9dd
SHA51298305c743dd6f62a8660ade2d44dc0a33d09c58599488fa50c80260c55fd2e455ed52adb39c5bc84189b52b319dc5377c52d14846957a5cf0c4a6ae45cbbf45f
-
Filesize
140KB
MD59da8bd3422fb22f0fc285818d8c3f15c
SHA1169c8ad53720308177bd2ab23c80b9c5bb486810
SHA25629a8d6f983254091d51ae0c5828b267683f0b3618ea16dfc7765be3a4f9bb9dd
SHA51298305c743dd6f62a8660ade2d44dc0a33d09c58599488fa50c80260c55fd2e455ed52adb39c5bc84189b52b319dc5377c52d14846957a5cf0c4a6ae45cbbf45f
-
Filesize
324KB
MD52f03c86a61ca5d85e08b6ca71b9ff42f
SHA147eca57f9899382e8806257baee446b7b5e2264d
SHA2563181bf399ec6fc0a9f8d816dfba604c28411a2c24d4b5fe63b79fc4c6fcd1241
SHA512963314d4e8f25489303ec54f011a63c229898bee9e36549612ae0109d6744ee43e679b5746abebc9dd78ae7a3c175393602d7dd7953fa56fa0f742cacdd7c3bf
-
Filesize
324KB
MD52f03c86a61ca5d85e08b6ca71b9ff42f
SHA147eca57f9899382e8806257baee446b7b5e2264d
SHA2563181bf399ec6fc0a9f8d816dfba604c28411a2c24d4b5fe63b79fc4c6fcd1241
SHA512963314d4e8f25489303ec54f011a63c229898bee9e36549612ae0109d6744ee43e679b5746abebc9dd78ae7a3c175393602d7dd7953fa56fa0f742cacdd7c3bf
-
Filesize
324KB
MD52f03c86a61ca5d85e08b6ca71b9ff42f
SHA147eca57f9899382e8806257baee446b7b5e2264d
SHA2563181bf399ec6fc0a9f8d816dfba604c28411a2c24d4b5fe63b79fc4c6fcd1241
SHA512963314d4e8f25489303ec54f011a63c229898bee9e36549612ae0109d6744ee43e679b5746abebc9dd78ae7a3c175393602d7dd7953fa56fa0f742cacdd7c3bf
-
Filesize
324KB
MD52f03c86a61ca5d85e08b6ca71b9ff42f
SHA147eca57f9899382e8806257baee446b7b5e2264d
SHA2563181bf399ec6fc0a9f8d816dfba604c28411a2c24d4b5fe63b79fc4c6fcd1241
SHA512963314d4e8f25489303ec54f011a63c229898bee9e36549612ae0109d6744ee43e679b5746abebc9dd78ae7a3c175393602d7dd7953fa56fa0f742cacdd7c3bf
-
Filesize
324KB
MD52f03c86a61ca5d85e08b6ca71b9ff42f
SHA147eca57f9899382e8806257baee446b7b5e2264d
SHA2563181bf399ec6fc0a9f8d816dfba604c28411a2c24d4b5fe63b79fc4c6fcd1241
SHA512963314d4e8f25489303ec54f011a63c229898bee9e36549612ae0109d6744ee43e679b5746abebc9dd78ae7a3c175393602d7dd7953fa56fa0f742cacdd7c3bf
-
Filesize
89KB
MD55bc0153d2973241b72a38c51a2f72116
SHA1cd9c689663557452631d9f8ff609208b01884a32
SHA25668ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554
SHA5122eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b
-
Filesize
89KB
MD55bc0153d2973241b72a38c51a2f72116
SHA1cd9c689663557452631d9f8ff609208b01884a32
SHA25668ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554
SHA5122eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b
-
Filesize
273B
MD5374bfdcfcf19f4edfe949022092848d2
SHA1df5ee40497e98efcfba30012452d433373d287d4
SHA256224a123b69af5a3ab0553e334f6c70846c650597a63f6336c9420bbe8f00571f
SHA512bc66dd6e675942a8b8cd776b0813d4b182091e45bfa7734b3818f58c83d04f81f0599a27625ff345d393959b8dbe478d8f1ed33d49f9bcee052c986c8665b8d7
-
Filesize
89KB
MD55bc0153d2973241b72a38c51a2f72116
SHA1cd9c689663557452631d9f8ff609208b01884a32
SHA25668ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554
SHA5122eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b